javascript

Chapter 19: Client - Side Storage
This extra information being sent back to the server can be used to uniquely identify the client from
which the request was sent.
Restrictions
Cookies are, by nature, tied to a specific domain. When a cookie is set, it is sent along with requests to
the same domain from which it was created. This restriction ensures that information stored in cookies is
available only to approved recipients and cannot be accessed by other domains.
Since cookies are stored on the client computer, restrictions have been put in place to ensure that cookies
can ’ t be used maliciously and that they won ’ t take up too much disk space. The total number of
cookies per domain is limited, although it varies from browser to browser. For example:
❑
❑
❑
❑
❑
Internet Explorer (IE) 6 and lower enforced a limit of 20 cookies per domain.
IE 7 and later have a limit of 50 cookies per domain. IE 7 initially shipped with support for a
maximum of 20 cookies per domain, but that was later updated with a patch from Microsoft.
Firefox limits cookies to 50 per domain.
Opera limits cookies to 30 per domain.
Safari and Chrome have no hard limit on the number of cookies per domain.
When cookies are set above the per - domain limit, the browser starts to eliminate previously set cookies.
IE and Opera begin by removing the least recently used (LRU) cookie to allow space for the newly set
cookie. Firefox seemingly randomly decides which cookies to eliminate, so it ’ s very important to mind
the cookie limit to avoid unintended consequences.
There are also limitations as to the size of cookies in browsers. Most browsers have a byte-count limit of
around 4096 bytes, give or take a byte. For best cross - browser compatibility, it ’ s best to keep the total
cookie size to 4095 bytes or less. The size limit applies to all cookies for a domain, not per cookie.
If you attempt to create a cookie that exceeds the maximum cookie size, the cookie is silently dropped.
Note that one character typically takes one byte, unless you ’ re using multibyte characters.
Cookie Parts
Cookies are made up of the following pieces of information stored by the browser:
❑
❑
❑
Name — A unique name to identify the cookie. Cookie names are case - insensitive, so myCookie
and MyCookie are considered to be the same. In practice, however, it ’ s always best to treat the
cookie names as case - sensitive because some server software may treat them as such. The cookie
name must be URL - encoded.
Value — The string value stored in the cookie. This value must also be URL - encoded.
Domain — The domain for which the cookie is valid. All requests sent from a resource at this
domain will include the cookie information. This value can include a subdomain (such as
www.wrox.com ) or exclude it (such as .wrox.com , which is valid for all subdomains of wrox
.com ). If not explicitly set, the domain is assumed to be the one from which the cookie was set.
618